September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18423 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object referen... |
high | 7.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-13327 Improper certificate validation on LDAPS connections to Active Directory in Devo... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-92177 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Executio... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92178 pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92179 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Executio... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92180 pdfforge PDF Architect activation-service Update Service Uncontrolled Search Pat... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92176 pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulne... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-79411 Incorrect privilege assignment in the admin user-management component of Webkul... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79410 Improper validation of the quantity parameter in the add-to-cart path of Webkul... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-69213 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-69208 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-69209 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-58728 In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race cond... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58734 In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds w... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58744 In multiple locations, there is a possible escalation of privilege due to improp... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58766 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58704 Google Pixel Improper Authorization Vulnerability |
high | 8.8 | Listed | Google / Pixel | 2026-09-15 | 2026-10-07 |
| CVE-2026-58699 In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58701 In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds wri... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58710 In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58724 In multiple locations, there is a possible use-after-free due to a race conditio... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58678 In Bootloader, there is a possible permission bypass due to a logic error in the... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58679 In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overfl... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58683 In IP Multimedia Subsystem, there is a possible out-of-bounds write due to impro... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58691 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58695 In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escala... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56997 In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds wri... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57008 In Modem, there is a possible information disclosure due to improper input valid... |
high | 7.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57012 In the Setup Wizard, there is a possible remote package install due to a missing... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57014 In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possib... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56970 In multiple locations, there is a possible permission bypass due to a missing pe... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56974 In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds wr... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56978 In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read d... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56982 In VPU, there is a possible permission bypass due to a missing permission check. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56985 In multiple files, there is a possible way to obtain signatures due to type conf... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56986 In multiple files, there is a possible out-of-bounds read due to type confusion. |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56941 In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due t... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56942 In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write du... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56945 In VPU, there is a possible out-of-bounds write due to a confused deputy. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56967 In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer... |
high | 8.0 | — | Google / android | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.